Data processing agreement
The terms under which we process your customers' personal data on your behalf, under Article 28 GDPR. Accepting the terms of service accepts this agreement.
This agreement is part of the terms of service. It applies whenever Auralata processes personal data on your behalf, under Article 28 GDPR, and it takes precedence over the terms where the two disagree about data protection.
1. Parties and roles
You, the shop that connects a WooCommerce store, are the controller. Fokus Labs OÜ, registered in Estonia, is the processor. We process personal data only on your documented instructions, which are given through the product itself and through this agreement.
2. Subject, duration, nature and purpose
- Subject: running marketing for your shop — generating content, building and sending campaigns, running flows, and reporting on them.
- Duration: for as long as your account exists, plus the deletion period in section 8.
- Nature: collection from your shop, storage, organisation, enrichment with engagement data, transmission to the channels you connect, and deletion.
- Purpose: only what you instruct. We do not use your customers' data for our own purposes, and we never sell it.
3. Categories of data and data subjects
Data subjects: your customers and subscribers, and the people in your team who use the product.
| Category | Examples |
|---|---|
| Identity and contact | Email, name, phone, city, country, language |
| Commercial | Orders, order value, products bought, carts, lifetime value |
| Consent | Per channel — email, SMS, WhatsApp, Viber — with source and timestamp |
| Engagement | Opens, clicks, deliveries, failures, flow membership, unsubscribes |
| Team | Name, email, role, actions in the approval and audit log |
We do not need, and ask you not to send, special categories of data under Article 9 — health, beliefs, biometrics and the rest.
4. Sub-processors
You give general authorisation for the sub-processors below. Each is bound by written terms no less protective than this agreement.
Always in use
| Sub-processor | What for | What it sees | Where |
|---|---|---|---|
| Hetzner Online GmbH | Hosting: the application, database, uploaded media and backups | Everything stored in the product — account data, shop and customer data, files | Nuremberg, Germany (EU) |
| Amazon Web Services EMEA SARL | Email delivery (Amazon SES) and delivery, bounce and complaint events (Amazon SNS) | Recipient email address, message content, delivery status | Frankfurt, Germany (EU) |
| OpenAI Ireland Ltd | AI text and image generation, when you use a feature that picks an OpenAI model | Your prompts, briefs, product details and product photos — not customer profiles | United States, under standard contractual clauses |
| Google Ireland Ltd | AI image generation with the Gemini models | Your prompts, briefs, product details and product photos — not customer profiles | United States and EU, under standard contractual clauses |
| Anthropic Ireland, Ltd | AI text generation, when you use a feature that picks a Claude model | Your prompts, briefs and product details — not customer profiles | United States, under standard contractual clauses |
Only if you use the feature
| Sub-processor | What for | What it sees | Where |
|---|---|---|---|
| Enable Banking Oy | Reading your bank account to match incoming transfers to orders — only if you connect a bank account | Account information and transactions of the account you connect (read-only) | Finland (EU) |
| Stripe Payments Europe, Ltd and PayPal (Europe) S.à r.l. | Taking the card or PayPal payment for your Auralata plan — only once payments are switched on | Billing details and payment data of the account owner | EU, with transfers to the United States under standard contractual clauses |
Not sub-processors
Meta, Google Ads and Google sign-in act on your own account when you connect them; they are your providers, not ours. The EU's VIES service checks a VAT number you give us and receives nothing else. Pexels receives a search word when you look for a stock photo, never personal data. Our own message-queue and cache run on the same server as the application, so they add no one.
Changes
We inform you at least 30 days before adding or replacing a sub-processor, in the product and by email. If you object on reasonable data-protection grounds within that period and we cannot offer an alternative, you may terminate the affected part of the service without penalty.
5. Security measures
- TLS 1.2 or better in transit; encryption at rest for databases, backups and stored media.
- Role-based access inside the product, and least-privilege access for our own team with mandatory two-factor authentication.
- Separate development, staging and production environments; production data is never copied into development.
- Daily backups with restores tested quarterly, and a documented recovery objective of 24 hours.
- An audit log in the product recording who created, approved, changed or deleted what, retained for 24 months.
- Dependency and vulnerability scanning, with a disclosure address at security@auralata.com acknowledged within 72 hours.
6. Helping you meet your obligations
We help with data-subject requests: profiles can be exported, corrected, anonymised or deleted from the product itself, and we answer any request we cannot solve that way within ten working days. We also assist with impact assessments and with prior consultation, to the extent the information is ours to give.
7. Personal data breach
If a breach affects your data we notify you without undue delay and within 72 hours of becoming aware, with what happened, which categories and roughly how many people are affected, the likely consequences, and what we are doing. We do not notify your customers on your behalf — that decision is yours as controller.
8. Deletion and return
On termination you can export everything from the product. Thirty days after the account closes we delete your customer data from active systems, and backups age out within a further 90 days. Anything we must keep by law — invoices, for example — is kept only for that purpose and is not otherwise processed.
9. Audits
You may audit our compliance once per year, or after a breach, with 30 days' notice. In the first instance we answer a written questionnaire and share our current documentation; an on-site audit is possible where that is genuinely insufficient, at your cost and under confidentiality.
10. International transfers
Where a sub-processor is outside the EEA, transfers rely on the European Commission's standard contractual clauses, on an adequacy decision, or on the EU–US Data Privacy Framework where the provider is certified. A copy of the clauses is available on request.
11. Signing this
Accepting the terms of service accepts this agreement. If your own compliance process needs a signed copy on paper or a countersigned version of your own template, write to info@auralata.com and we will do it.